PT-2010-5292

Name of the Vulnerable Software and Affected Versions Aardvark Topsites PHP versions 5.2.0 through 5.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the mail, title, u, and url parameters in index.php. Recommendations For versions 5.2.0 and 5.2.1,...

CVE-2010-3712: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving "multiple encoded entities," as demonstrated by the query string to index.php in the comweblinks or comcontent componen...

CVE-2010-4097: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple XSS Vulnerabilities

Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple Cross-Site Scripting Vulnerability. SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1005 09/07/2010 Issue Discovered 09/10/2010 Vendor Notified 09/13/2010 Vendor Confirmed 09/14/2010 Fix Available Class: Cross-Si...

Joomla Flash Fun Local File Inclusion

========================================================= Joomla Component comjoomlaflashfun LFI Vulnerability ========================================================= +Title : Joomla Component comjoomlaflashfun LFI Vulnerability +Author : josalijoe +Contact : [email protected] +Home :...

Stadtaus Voting 1.9.1 Remote File Inclusion

Dr4cula.Us Stadtaus Voting v1.9.1 Remote File Include Vulnerability Download Script : http://scripti.org/scriptstadtaus-anket-scripti19016.html Author : Dracula Contact : [email protected] Location : Türkiye Blog : http://dr4cula.us Dork : Stadtaus voting File : index.php include $scriptroot...

Stadtaus Voting v1.9.1 Remote File Include Vulnerability

Exploit for php platform in category web applications ======================================================== Stadtaus Voting v1.9.1 Remote File Include Vulnerability ======================================================== Dr4cula.Us Stadtaus Voting v1.9.1 Remote File Include Vulnerability...

Joomla Basdv Local File Inclusion / Directory Traversal

combsadv Directory Traversal Vulnerability Author : Fl0riX | Bug Researchers ! Greetz: Sakkure And All My Friends ! ScriptName: Joomla combsadv ! Demo :http://www.simons5.com/portal/ ! Example; /index.php?option=combsadv&controller=../../../../../../../../etc/passwd%00...

CuteNews - page Local File Inclusion

CuteNews - page Local File Inclusion ========================================================== CuteNews page local File Inclusion Vulnerability ========================================================== vendor: http://cutephp.com/ Author: eidelweiss Contact: eidelweiss at windowslive dot com...

PT-2010-4723

Name of the Vulnerable Software and Affected Versions Free Simple CMS versions 1.0 and earlier Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the body, footer, header, menu left, or menu right parameter. This can be achieved by exploiting remote file...

PT-2010-5036

Name of the Vulnerable Software and Affected Versions Free Simple CMS version 1.0 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the meta or phpincdir parameter in the themes/default/index.php file. Recommendations For Free Simple CMS version 1.0, conside...

CVE-2010-3307: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 body, 2 footer, 3 header, 4 menuleft, or 5 menuright parameter...

CVE-2010-3742: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 meta or 2 phpincdir parameter, a different issue than CVE-2010-3307...

CuteNews - 'page' Local File Inclusion

========================================================== CuteNews page local File Inclusion Vulnerability ========================================================== vendor: http://cutephp.com/ Author: eidelweiss Contact: eidelweiss at windowslive dot com...

CuteNews Local File Inclusion

========================================================== CuteNews page local File Inclusion Vulnerability ========================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ ...

Display event CMS SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= Display event CMS SQL Injection Vulnerability ============================================= + Auth0r : Game Over + E-m41L : gameover20atlivedotcom + D0rk : inurl:index.php?action=cms.display + S-Si...

Zen Cart 1.3.9f Local File Inclusion

Zen Cart v1.3.9f typefilter Local File Inclusion Vulnerability Vendor: Zen Ventures, LLC Product web page: http://www.zen-cart.com Version affected: 1.3.9f Summary: Zen Cart is an online store management system. It is PHP-based, using a MySQL database and HTML components. Support is provided for...

phpMyFAQ 2.6.x index.php跨站脚本漏洞

BUGTRAQ ID: 43560 phpMyFAQ是一款多语言、基于数据库的FAQ系统。 phpMyFAQ没有正确地过滤提交给index.php页面的请求参数便返回给了用户。远程攻击者可以通过提交恶意的URL请求向页面输出注入JavaScript代码，导致窃取域Cookie。 phpMyFAQ 2.6.x 厂商补丁： phpMyFAQ -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.phpmyfaq.de/ http://www.example.com/index.php/"scriptalert"XSS"/script...

PHPMyFAQ 2.6.x - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43560/info phpMyFAQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

CVE-2010-3607

Cross-site scripting XSS vulnerability in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the id parameter...